KeyTap

Support

Support

Questions, problems or ideas: write to support@keytap.me. We read every message.

It helps to tell us your iPhone model and iOS version, your computer’s system, your YubiKey® model, and what the app and the terminal showed. Please never send your PIN, a key or a decrypted file.

First, try the dry run

It checks the whole chain without decrypting anything, and usually points at the broken link:

age-plugin-yubikey-phone test

Frequently asked questions

The app says Local Network access is denied

iOS asks once whether KeyTap may reach devices on your network. If you said no, open Settings → KeyTap → Local Network on your iPhone and switch it on, then try again.

The phone cannot reach the computer

Check that the phone and the computer are on the same network, or that the phone is connected to your VPN. Check that the address you gave to pair --host is the one the phone can reach – it must be an address of this computer on that network, not localhost. The bridge listens on that address only, on port 8743, and only while a decrypt waits, so allow the port in the computer’s firewall. If the address changed, pair again: age-plugin-yubikey-phone pair --host <IP of this computer>.

Where do I hold the YubiKey?

Against the top back edge of the iPhone, where the NFC antenna is. Hold it still until the app confirms; a thick case can get in the way.

Wrong PIN, or the PIN is locked

The YubiKey allows 3 PIN tries in a row. After that it is blocked, but it can be unblocked with the PUK: on a computer run ykman piv access unblock-pin. KeyTap never stores or resets your PIN.

I have several YubiKeys

Tap each of them against the phone while pairing – the bridge registers every key you tap. A file sealed to several of your keys then still gives one prompt. Run age-plugin-yubikey-phone devices to see what is registered; to add a key later, pair again.

How do I pair again, for example with a new address or a new phone?

In the app open Settings → Set Up Again, then run age-plugin-yubikey-phone pair --host <IP of this computer> again and copy the new link into the app. Pairing the same phone again replaces its old entry.

How do I reset or unpair?

On the computer: age-plugin-yubikey-phone unpair NAME (see the names with age-plugin-yubikey-phone devices). On the phone: Settings → Unpair. Both remove the pairing; neither touches your YubiKey.

Nothing happens when I decrypt

The app must be open – KeyTap has no push notifications, on purpose. Also check that the bridge is the plugin your tools find: command -v age-plugin-yubikey should point to the bridge (see the shim). A request expires after 120 seconds.

Is there a KeyTap account, server or subscription?

No. KeyTap is free, has no accounts and no servers; the phone talks only to your own computer. See the privacy policy.

More